Shadowgraph
TrendingAbout
Sign in

dckc/awesome-ocap

Awesome Object Capabilities and Capability Security

JavaScript

414

180 commits

updated Sep 20, 2026

See the code

README

Awesome Object Capabilities and Capability-based Security

Awesome

Alice sends a greet message to Bob with a reference to Carol

Capability-based security enables the concise composition of powerful patterns of cooperation without vulnerability.

In 3 minutes:

In 15 minutes:

Or for a detailed explanation: What Are Capabilities? by Morningstar in 2017.

Applications and Services

Libraries and Frameworks

Programming Languages

  • Pony is an open-source, object-oriented, actor-model, capabilities-secure, high performance programming language.

  • Austral - a systems language with linear types and capability security

  • Newspeak is an object-capability programming platform that lets you develop code in your web browser. Like Self, Newspeak is message-based; all names are dynamically bound. However, like Smalltalk, Newspeak uses classes rather than prototypes. The current version of Newspeak runs on top of WASM.

  • Monte is a nascent dynamic programming language reminiscent of Python and E. It is based upon The Principle of Least Authority (POLA), which governs interactions between objects, and a capability-based object model, which grants certain essential safety guarantees to all objects.

    • bootstrapped from rpython (pypy toolchain) and libuv and libsodium using (primarily) the nix build system.
    • Docker images: montelang
    • 2017-03: Monte: A Spiritual Successor to E presented by Corbin Simpson at OCAP 2017

  • Cadence is a smart contract language with resources (linear types) and capability security. Its static type system has direct support for object-capability security. For example, the facade pattern is natively supported, and the type system has special down-casting rules to express access control patterns.

Operating Systems

  • genode is a novel OS architecture that is able to master the complexity of code and policy -- the most fundamental security problem shared by modern general-purpose operating systems -- by applying a strict organizational structure to all software components including device drivers, system services, and applications.

    • 2025-11: Genode OS Framework release 25.11 – improves custom-kernel interactive performance, adds GPU-accelerated graphics on Intel Alder Lake, introduces USB-serial support, and enables seL4 on 64-bit ARM

    • 2025-08: Genode OS Framework release 25.08 – redesigns the kernel scheduler for fairness and low latency, updates Linux-based PC drivers to 6.12, and expands dynamic scenarios for seL4 13.0

    • 2025-04: Sculpt OS release 25.04 – introduces multi-monitor window management and display rotation, integrates Chromium WebEngine 112, and extends hardware support to Intel Meteor Lake and F&S i.MX8MP armStone boards

    • 2025-02: Genode OS Framework release 25.02 – extends multi-monitor capabilities to window management and virtual machines, ports QEMU and Chromium WebEngine 112, boosts graphics performance via SIMD optimizations

    • 2024-11: Genode OS Framework release 24.11 – multi-monitor display support and the Genode Applications book signal a maturity milestone for desktop use

    • 2024-05: Genode OS Framework release 24.05 – Sculpt OS now runs on Genode’s custom kernel and gains GDB debugging support; USB stack redesigned

    • 2020-06: Re-stacking the GUI stack – a deep architectural rethink of desktop graphics: Genode inverts the usual GUI-server/driver relationship so input and display drivers stay in control of policy-critical resources, shrinking the consequences of compromise in one of the OS's most attack-prone subsystems

    • 2020-05-28 Genode OS Framework 20.05 with Capability-based security using seccomp on Linux, ...

    • 2018-02: On-target package installation and deployment – introduces a package management model where untrusted tools like curl, libarchive, and GnuPG are used within tightly confined compartments; a ~1000-line download manager orchestrates deployment without expanding the TCB

  • Fuchsia is a real-time operating system in development by Google since Aug 2016. It's based on a microkernel, Zircon, with a capability security model.

    • 2021-06 cr0 blog: A few thoughts on Fuchsia security Julien Tinnes. Sandboxing is trivial. In fact a new process with access to no capabilities

    • 2026-01: Fuchsia F29 release notes – expands Component Framework support for SDK-exposed StorageAdmin and programmatic storage routing in Realm Builder, continuing Fuchsia’s explicit capability-routing model

    • 2025-10: Fuchsia F28 release notes – enables a new HTTP/S manifest-driven OTA flow and continues migration from legacy driver interfaces to DFv2 and FIDL services

    • 2025-04: Fuchsia F26 release notes – continues refinement of the component framework, emphasizing explicit capability routing, lifecycle control, and modular isolation between components

    • 2025-01: Fuchsia F24 release notes – introduces improvements in diagnostics scoping and structured logging, reinforcing least-authority principles in observability tooling

    • 2024-03: Fuchsia OS powers all Nest Hub devices – Fuchsia’s capability-based component framework is now deployed across all Nest Hub models, replacing the legacy Cast OS; each system component runs with only the capabilities it is explicitly granted, demonstrating ocap principles at scale in a mainstream consumer product

    • 2020-11: Fuchsia Component Framework – Fuchsia’s core architectural model based on sandboxed components and explicit capability routing, offering a native implementation of capability-secure composition

    • 2017-05-08 Google’s “Fuchsia” smartphone OS dumps Linux, has a wild new UI Ars Technica

  • seL4 is the world's first operating-system kernel with an end-to-end proof of implementation correctness and security enforcement; it is available as open source.

  • Capsicum Capsicum is a lightweight OS capability and sandbox framework that extends the POSIX API, providing several new OS primitives to support object-capability security on UNIX-like operating systems

    • 2025-06: Sandbox Your Program Using FreeBSD's Capsicum – BSDCan tutorial on practical "Capsicumization", including pre-opened resources, compartmentalization, and libcasper service patterns such as cap_net
    • 2024-11: Strengthening FreeBSD: Addressing Vulnerabilities Through Synacktiv’s Code Audit – reports a security audit covering Capsicum and bhyve; findings led to fixes and robustness improvements in the trusted computing base around the sandbox
    • 2024-08: FreeBSD Status Report - Second Quarter 2024 – capsicum-rs gained libcasper(3) and cap_net(3) support and was being used by nfs-exporter and a TLS-enabled FTP server, showing current Rust adoption
    • 2023-06: Capsicum Internship – FreeBSD Foundation funded work to revitalize Capsicum tooling and ease sandboxing of existing daemons such as syslogd, rpcbind, tftpd, ntpd, and libarchive
    • Watson, R. N. M. 2013 Capsicum year in review. Light Blue Touchpaper, 20 December, 2013. Robert Watson reviews Capsicum events from 2013: work funded by the FreeBSD Foundation and Google on FreeBSD 10.0, Casper in FreeBSD 11, David Drysdale's port of Capsicum to Linux at Google, Summer of Code students, joint work with the University of Wisconsin on Capsicum, and future funded Capsicum work.

  • Spectrum is a Linux-based operating system focused on security by compartmentalization, aiming to make isolated application environments easier to use and maintain.

    • 2025-11: Documentation: Update support – documents developer-enabled atomic OS updates built on systemd-sysupdate, showing ongoing work toward maintainable compartmentalized systems

  • KataOS - embeded platform that runs on top of seL4

    • 2022-10: Announcing KataOS and Sparrow | Google Open Source Blog “As the foundation for this new operating system, we chose seL4 as the microkernel because it puts security front and center; it is mathematically proven secure, with guaranteed confidentiality, integrity, and availability.”

CPUs and Embedded Devices

  • Moddable "Moddable brings the JavaScript ecosystem to embedded software development"
    • 2024-07 Introducing Moddable Six "Moddable Six is for developers who want to use industry standard JavaScript to deliver dynamic IoT projects, especially those with a rich, mobile-style user experience."
  • CHERI is an open source capability CPU design.
    • 2022-01 Arm releases experimental CHERI-enabled Morello board as part of £187M UKRI Digital Security by Design programme CHERI implements architectural capabilities that directly enable software security features such as fine-grained memory protection and scalable software compartmentalisation — both important software vulnerability mitigation techniques that are not well supported on current processor architectures. ... memory-safe C compilation and linkage ...
    • 2019-09 The Arm Morello Board Arm announced Morello, an experimental CHERI-extended, multicore, superscalar ARMv8-A processor, System-on-Chip (SoC), and prototype board to be available from late 2021. Morello is a part of the UKRI £187M Digital Security by Design Challenge (DSbD) supported by the UK Industrial Strategy Challenge Fund, including a commitment of over £50M commitment by Arm.
    • 2019-09 An Introduction to CHERI

      CHERI (Capability Hardware Enhanced RISC Instructions) extends conventional processor Instruction-Set Architectures (ISAs) with architectural capabilities to enable fine-grained memory protection and highly scalable software compartmentalization. CHERI’s hybrid capability-system approach allows architectural capabilities to be integrated cleanly with contemporary RISC architectures and microarchitectures, as well as with MMU-based C/C++- language software stacks.

      CHERI’s capabilities are unforgeable tokens of authority, which can be used to implement both explicit pointers (those declared in the language) and implied pointers (those used by the runtime and generated code) in C and C++. When used for C/C++ memory protection, CHERI directly mitigates a broad range of known vulnerability types and exploit techniques. Support for more scalable software compartmentalization facilitates software mitigation techniques such as sandboxing, which also defend against future (currently unknown) vulnerability classes and exploit techniques.

      We have developed, evaluated, and demonstrated this approach through hardware-software prototypes, including multiple CPU prototypes, and a full software stack. This stack includes an adapted version of the Clang/LLVM compiler suite with support for capability-based C/C++, and a full UNIX-style OS (CheriBSD, based on FreeBSD) implementing spatial, referential, and (currently for userspace) non-stack temporal memory safety. Formal modeling and verification allow us to make strong claims about the security properties of CHERI-enabled architectures.

      This report is a high-level introduction to CHERI. The report describes our architectural approach, CHERI’s key microarchitectural implications, our approach to formal modeling and proof, the CHERI software model, our software-stack prototypes, further reading, and potential areas of future research.

    • June 2016: CHERI ISAv5 specification: improves the maturity of 128-bit capabilities, code efficiency, and description of the protection model.
    • June 2016: CHERI-JNI: Sinking the Java security model into the C, explores how CHERI capabilities can be used to support sandboxing with safe and efficient memory sharing between Java Native Interface (JNI) code and the Java Virtual Machine. ASPLOS 2017
    • May 2016: slides from the first CHERI microkernel workshop, Cambridge, UK in April 2016.

Presentations, Talks, Slides, and Videos

Articles

  • 2018-11 POLA Would Have Prevented the Event-Stream Incident
    Kate Sills, Agoric

  • 2017-06 Capability-Based Network Communication for Capsicum/CloudABI April–June 2017 FreeBSD status report.

  • 2017-05 What Are Capabilities? by Chip Morningstar (Hacker News discussion Jan 7, 2018)

  • 2016-08 Welcoming all Python enthusiasts: CPython 3.6 for CloudABI! August 1, 2016 by Ed Schouten

  • 2016-01: fun with Capper and OFX financial transaction fetching to cap-talk

    • Capper is a web application server built on Node.js/Express using the Waterken webkey protocol for object capability security.

  • 2015-11 Objects as Secure Capabilities Joe Duffy

  • 2009-03 Not One Click for Security Karp, Alan H.; Stiegler, Marc; Close, Tyler, HP Laboratories, HPL-2009-53 Conventional wisdom holds that security must negatively affect usability. We have developed SCoopFS (Simple Cooperative File Sharing) as a demonstration that need not be so. SCoopFS addresses the problem of sharing files, both with others and with ourselves across machines. Although SCoopFS provides server authentication, client authorization, and end-to-end encryption, the user never sees any of that. The user interface and underlying infrastructure are designed so that normal user acts of designation provide all the information needed to make the desired security decisions. While SCoopFS is a useful tool, it may be more important as a demonstration of the usability that comes from designing the infrastructure and user interaction together.

  • 2009-02 ACLs don't Tyler Close, HP Laboratories The ACL model is unable to make correct access decisions for interactions involving more than two principals, since required information is not retained across message sends. Though this deficiency has long been documented in the published literature, it is not widely understood. This logic error in the ACL model is exploited by both the clickjacking and Cross-Site Request Forgery attacks that affect many Web applications

  • 2002-06 DarpaBrowser: Final Report by Marc Stiegler and Mark Miller
    The broad goal of this research was to assess whether capability-based security [Levy84] could achieve security goals that are unachievable with current traditional security technologies such as access control lists and firewalls. The specific goal of this research was to create an HTML browser that could use capability confinement on a collection of plug-replaceable, possibly malicious, rendering engines. In confining the renderer, the browser would ensure that a malicious renderer could do no harm either to the browser or to the underlying system.

Peer-reviewed Articles

See also Usable Security and Capabilities bibliography.

  • D. Devriese, Birkedal, and Piessens
    Reasoning about Object Capabilities with Logical Relations and Effect Parametricity
    1st IEEE European Symposium on Security and Privacy, Congress Center Saar, Saarbrücken, GERMANY, 2016.

  • 2015 Clean Application Compartmentalization with SOAAP Khilan Gudka, Robert N. M. Watson, Jonathan Anderson, David Chisnall, Brooks Davis, Ben Laurie, Ilias Marinos, Peter G. Neumann, and Alex Richardson. ACM CCS 2015.

  • Gerwin Klein, June Andronick, Kevin Elphinstone, Toby Murray, Thomas Sewell, Rafal Kolanski and Gernot Heiser
    Comprehensive formal verification of an OS microkernel
    ACM Transactions on Computer Systems, Volume 32, Number 1, pp. 2:1-2:70, February, 2014

  • S. Clebsch and S. Drossopoulou
    Fully concurrent garbage collection of actors on many-core machines
    OOPSLA 2013

  • Mark S. Miller, Tom Van Cutsem, Bill Tulloh
    Distributed Electronic Rights in JavaScript
    ESOP'13 22nd European Symposium on Programming, Springer (2013)

  • Maffeis, Sergio, John C. Mitchell, and Ankur Taly. Object capabilities and isolation of untrusted web applications. In 2010 IEEE Symposium on Security and Privacy, pp. 125-140. IEEE, 2010.

  • 2010 Capsicum: Practical Capabilities for UNIX Robert N. M. Watson, Jonathan Anderson, Ben Laurie, and Kris Kennaway. USENIX Security 2010.

  • Barth, Adam, Joel Weinberger, and Dawn Song.
    Cross-Origin JavaScript Capability Leaks: Detection, Exploitation, and Defense. USENIX security symposium. 2009.

  • Close, T.: Web-key: Mashing with permission. In: W2SP’08. (2008)

  • Miller MS
    Robust composition: towards a unified approach to access control and concurrency control
    Ph.D. Thesis, Johns Hopkins University; 2006.

    When separately written programs are composed so that they may cooperate, they may instead destructively interfere in unanticipated ways. These hazards limit the scale and functionality of the software systems we can successfully compose. This dissertation presents a framework for enabling those interactions between components needed for the cooperation we intend, while minimizing the hazards of destructive interference.

    Great progress on the composition problem has been made within the object paradigm, chiefly in the context of sequential, single-machine programming among benign components. We show how to extend this success to support robust composition of concurrent and potentially malicious components distributed over potentially malicious machines. We present E, a distributed, persistent, secure programming language, and CapDesk, a virus-safe desktop built in E, as embodiments of the techniques we explain.

  • Miller, Mark S., E. Dean Tribble, and Jonathan Shapiro. Concurrency among strangers. TGC. Vol. 5. 2005.

  • Mark S. Miller, Chip Morningstar, Bill Frantz
    Capability-based Financial Instruments
    Proc. Financial Cryptography 2000, Springer-Verlag, Anguila, BWI, pp. 349-378.

    Every novel cooperative arrangement of mutually suspicious parties interacting electronically — every smart contract — effectively requires a new cryptographic protocol. However, if every new contract requires new cryptographic protocol design, our dreams of cryptographically enabled electronic commerce would be unreachable. Cryptographic protocol design is too hard and expensive, given our unlimited need for new contracts. Just as the digital logic gate abstraction allows digital circuit designers to create large analog circuits without doing analog circuit design, we present cryptographic capabilities as an abstraction allowing a similar economy of engineering effort in creating smart contracts. We explain the E system, which embodies these principles, and show a covered-call-option as a smart contract written in a simple security formalism independent of cryptography, but automatically implemented as a cryptographic protocol coordinating five mutually suspicious parties

Star History

Star History Chart

awesome
awesome-list
capabilities
capability-based
javascript
ocap
ocaps
security
web-security

Contributors

dckc

167 commits

wsargent

3 commits

kephas

1 commits

meejah

1 commits

Similar repos

endojs/endo

Endo is a distributed secure JavaScript sandbox, based on SES

1,062

cloudflare/cloudflare-os

Agent workspace built on Cloudflare Workers for creating documents, building apps, and running…

10,027

cloudflare/capnweb

JavaScript/TypeScript-native, low-boilerplate, object-capability RPC system

3,988

sindresorhus/awesome

😎 Awesome lists about all kinds of interesting topics [NOTE: Pull requests are temporarily…

508,797

bayandin/awesome-awesomeness

A curated list of awesome awesomeness

33,680

tldrsec/awesome-secure-defaults

Awesome secure by default libraries to help you eliminate bug classes!

725

anaibol/awesome-serverless

:cloud: A curated list of awesome services, solutions and resources for serverless / nobackend…

7,584

osirislab/awesome-rust-security

Curated list of awesome projects and resources related to Rust and computer security

605

Languages

JavaScript

60.0%

Python

40.0%

dckc/awesome-ocap

Awesome Object Capabilities and Capability Security

JavaScript

414

180 commits

updated Sep 20, 2026

See the code

README

Awesome Object Capabilities and Capability-based Security

Awesome

Alice sends a greet message to Bob with a reference to Carol

Capability-based security enables the concise composition of powerful patterns of cooperation without vulnerability.

In 3 minutes:

In 15 minutes:

Or for a detailed explanation: What Are Capabilities? by Morningstar in 2017.

Applications and Services

Libraries and Frameworks

Programming Languages

  • Pony is an open-source, object-oriented, actor-model, capabilities-secure, high performance programming language.

  • Austral - a systems language with linear types and capability security

  • Newspeak is an object-capability programming platform that lets you develop code in your web browser. Like Self, Newspeak is message-based; all names are dynamically bound. However, like Smalltalk, Newspeak uses classes rather than prototypes. The current version of Newspeak runs on top of WASM.

  • Monte is a nascent dynamic programming language reminiscent of Python and E. It is based upon The Principle of Least Authority (POLA), which governs interactions between objects, and a capability-based object model, which grants certain essential safety guarantees to all objects.

    • bootstrapped from rpython (pypy toolchain) and libuv and libsodium using (primarily) the nix build system.
    • Docker images: montelang
    • 2017-03: Monte: A Spiritual Successor to E presented by Corbin Simpson at OCAP 2017

  • Cadence is a smart contract language with resources (linear types) and capability security. Its static type system has direct support for object-capability security. For example, the facade pattern is natively supported, and the type system has special down-casting rules to express access control patterns.

Operating Systems

  • genode is a novel OS architecture that is able to master the complexity of code and policy -- the most fundamental security problem shared by modern general-purpose operating systems -- by applying a strict organizational structure to all software components including device drivers, system services, and applications.

    • 2025-11: Genode OS Framework release 25.11 – improves custom-kernel interactive performance, adds GPU-accelerated graphics on Intel Alder Lake, introduces USB-serial support, and enables seL4 on 64-bit ARM

    • 2025-08: Genode OS Framework release 25.08 – redesigns the kernel scheduler for fairness and low latency, updates Linux-based PC drivers to 6.12, and expands dynamic scenarios for seL4 13.0

    • 2025-04: Sculpt OS release 25.04 – introduces multi-monitor window management and display rotation, integrates Chromium WebEngine 112, and extends hardware support to Intel Meteor Lake and F&S i.MX8MP armStone boards

    • 2025-02: Genode OS Framework release 25.02 – extends multi-monitor capabilities to window management and virtual machines, ports QEMU and Chromium WebEngine 112, boosts graphics performance via SIMD optimizations

    • 2024-11: Genode OS Framework release 24.11 – multi-monitor display support and the Genode Applications book signal a maturity milestone for desktop use

    • 2024-05: Genode OS Framework release 24.05 – Sculpt OS now runs on Genode’s custom kernel and gains GDB debugging support; USB stack redesigned

    • 2020-06: Re-stacking the GUI stack – a deep architectural rethink of desktop graphics: Genode inverts the usual GUI-server/driver relationship so input and display drivers stay in control of policy-critical resources, shrinking the consequences of compromise in one of the OS's most attack-prone subsystems

    • 2020-05-28 Genode OS Framework 20.05 with Capability-based security using seccomp on Linux, ...

    • 2018-02: On-target package installation and deployment – introduces a package management model where untrusted tools like curl, libarchive, and GnuPG are used within tightly confined compartments; a ~1000-line download manager orchestrates deployment without expanding the TCB

  • Fuchsia is a real-time operating system in development by Google since Aug 2016. It's based on a microkernel, Zircon, with a capability security model.

    • 2021-06 cr0 blog: A few thoughts on Fuchsia security Julien Tinnes. Sandboxing is trivial. In fact a new process with access to no capabilities

    • 2026-01: Fuchsia F29 release notes – expands Component Framework support for SDK-exposed StorageAdmin and programmatic storage routing in Realm Builder, continuing Fuchsia’s explicit capability-routing model

    • 2025-10: Fuchsia F28 release notes – enables a new HTTP/S manifest-driven OTA flow and continues migration from legacy driver interfaces to DFv2 and FIDL services

    • 2025-04: Fuchsia F26 release notes – continues refinement of the component framework, emphasizing explicit capability routing, lifecycle control, and modular isolation between components

    • 2025-01: Fuchsia F24 release notes – introduces improvements in diagnostics scoping and structured logging, reinforcing least-authority principles in observability tooling

    • 2024-03: Fuchsia OS powers all Nest Hub devices – Fuchsia’s capability-based component framework is now deployed across all Nest Hub models, replacing the legacy Cast OS; each system component runs with only the capabilities it is explicitly granted, demonstrating ocap principles at scale in a mainstream consumer product

    • 2020-11: Fuchsia Component Framework – Fuchsia’s core architectural model based on sandboxed components and explicit capability routing, offering a native implementation of capability-secure composition

    • 2017-05-08 Google’s “Fuchsia” smartphone OS dumps Linux, has a wild new UI Ars Technica

  • seL4 is the world's first operating-system kernel with an end-to-end proof of implementation correctness and security enforcement; it is available as open source.

  • Capsicum Capsicum is a lightweight OS capability and sandbox framework that extends the POSIX API, providing several new OS primitives to support object-capability security on UNIX-like operating systems

    • 2025-06: Sandbox Your Program Using FreeBSD's Capsicum – BSDCan tutorial on practical "Capsicumization", including pre-opened resources, compartmentalization, and libcasper service patterns such as cap_net
    • 2024-11: Strengthening FreeBSD: Addressing Vulnerabilities Through Synacktiv’s Code Audit – reports a security audit covering Capsicum and bhyve; findings led to fixes and robustness improvements in the trusted computing base around the sandbox
    • 2024-08: FreeBSD Status Report - Second Quarter 2024 – capsicum-rs gained libcasper(3) and cap_net(3) support and was being used by nfs-exporter and a TLS-enabled FTP server, showing current Rust adoption
    • 2023-06: Capsicum Internship – FreeBSD Foundation funded work to revitalize Capsicum tooling and ease sandboxing of existing daemons such as syslogd, rpcbind, tftpd, ntpd, and libarchive
    • Watson, R. N. M. 2013 Capsicum year in review. Light Blue Touchpaper, 20 December, 2013. Robert Watson reviews Capsicum events from 2013: work funded by the FreeBSD Foundation and Google on FreeBSD 10.0, Casper in FreeBSD 11, David Drysdale's port of Capsicum to Linux at Google, Summer of Code students, joint work with the University of Wisconsin on Capsicum, and future funded Capsicum work.

  • Spectrum is a Linux-based operating system focused on security by compartmentalization, aiming to make isolated application environments easier to use and maintain.

    • 2025-11: Documentation: Update support – documents developer-enabled atomic OS updates built on systemd-sysupdate, showing ongoing work toward maintainable compartmentalized systems

  • KataOS - embeded platform that runs on top of seL4

    • 2022-10: Announcing KataOS and Sparrow | Google Open Source Blog “As the foundation for this new operating system, we chose seL4 as the microkernel because it puts security front and center; it is mathematically proven secure, with guaranteed confidentiality, integrity, and availability.”

CPUs and Embedded Devices

  • Moddable "Moddable brings the JavaScript ecosystem to embedded software development"
    • 2024-07 Introducing Moddable Six "Moddable Six is for developers who want to use industry standard JavaScript to deliver dynamic IoT projects, especially those with a rich, mobile-style user experience."
  • CHERI is an open source capability CPU design.
    • 2022-01 Arm releases experimental CHERI-enabled Morello board as part of £187M UKRI Digital Security by Design programme CHERI implements architectural capabilities that directly enable software security features such as fine-grained memory protection and scalable software compartmentalisation — both important software vulnerability mitigation techniques that are not well supported on current processor architectures. ... memory-safe C compilation and linkage ...
    • 2019-09 The Arm Morello Board Arm announced Morello, an experimental CHERI-extended, multicore, superscalar ARMv8-A processor, System-on-Chip (SoC), and prototype board to be available from late 2021. Morello is a part of the UKRI £187M Digital Security by Design Challenge (DSbD) supported by the UK Industrial Strategy Challenge Fund, including a commitment of over £50M commitment by Arm.
    • 2019-09 An Introduction to CHERI

      CHERI (Capability Hardware Enhanced RISC Instructions) extends conventional processor Instruction-Set Architectures (ISAs) with architectural capabilities to enable fine-grained memory protection and highly scalable software compartmentalization. CHERI’s hybrid capability-system approach allows architectural capabilities to be integrated cleanly with contemporary RISC architectures and microarchitectures, as well as with MMU-based C/C++- language software stacks.

      CHERI’s capabilities are unforgeable tokens of authority, which can be used to implement both explicit pointers (those declared in the language) and implied pointers (those used by the runtime and generated code) in C and C++. When used for C/C++ memory protection, CHERI directly mitigates a broad range of known vulnerability types and exploit techniques. Support for more scalable software compartmentalization facilitates software mitigation techniques such as sandboxing, which also defend against future (currently unknown) vulnerability classes and exploit techniques.

      We have developed, evaluated, and demonstrated this approach through hardware-software prototypes, including multiple CPU prototypes, and a full software stack. This stack includes an adapted version of the Clang/LLVM compiler suite with support for capability-based C/C++, and a full UNIX-style OS (CheriBSD, based on FreeBSD) implementing spatial, referential, and (currently for userspace) non-stack temporal memory safety. Formal modeling and verification allow us to make strong claims about the security properties of CHERI-enabled architectures.

      This report is a high-level introduction to CHERI. The report describes our architectural approach, CHERI’s key microarchitectural implications, our approach to formal modeling and proof, the CHERI software model, our software-stack prototypes, further reading, and potential areas of future research.

    • June 2016: CHERI ISAv5 specification: improves the maturity of 128-bit capabilities, code efficiency, and description of the protection model.
    • June 2016: CHERI-JNI: Sinking the Java security model into the C, explores how CHERI capabilities can be used to support sandboxing with safe and efficient memory sharing between Java Native Interface (JNI) code and the Java Virtual Machine. ASPLOS 2017
    • May 2016: slides from the first CHERI microkernel workshop, Cambridge, UK in April 2016.

Presentations, Talks, Slides, and Videos

Articles

  • 2018-11 POLA Would Have Prevented the Event-Stream Incident
    Kate Sills, Agoric

  • 2017-06 Capability-Based Network Communication for Capsicum/CloudABI April–June 2017 FreeBSD status report.

  • 2017-05 What Are Capabilities? by Chip Morningstar (Hacker News discussion Jan 7, 2018)

  • 2016-08 Welcoming all Python enthusiasts: CPython 3.6 for CloudABI! August 1, 2016 by Ed Schouten

  • 2016-01: fun with Capper and OFX financial transaction fetching to cap-talk

    • Capper is a web application server built on Node.js/Express using the Waterken webkey protocol for object capability security.

  • 2015-11 Objects as Secure Capabilities Joe Duffy

  • 2009-03 Not One Click for Security Karp, Alan H.; Stiegler, Marc; Close, Tyler, HP Laboratories, HPL-2009-53 Conventional wisdom holds that security must negatively affect usability. We have developed SCoopFS (Simple Cooperative File Sharing) as a demonstration that need not be so. SCoopFS addresses the problem of sharing files, both with others and with ourselves across machines. Although SCoopFS provides server authentication, client authorization, and end-to-end encryption, the user never sees any of that. The user interface and underlying infrastructure are designed so that normal user acts of designation provide all the information needed to make the desired security decisions. While SCoopFS is a useful tool, it may be more important as a demonstration of the usability that comes from designing the infrastructure and user interaction together.

  • 2009-02 ACLs don't Tyler Close, HP Laboratories The ACL model is unable to make correct access decisions for interactions involving more than two principals, since required information is not retained across message sends. Though this deficiency has long been documented in the published literature, it is not widely understood. This logic error in the ACL model is exploited by both the clickjacking and Cross-Site Request Forgery attacks that affect many Web applications

  • 2002-06 DarpaBrowser: Final Report by Marc Stiegler and Mark Miller
    The broad goal of this research was to assess whether capability-based security [Levy84] could achieve security goals that are unachievable with current traditional security technologies such as access control lists and firewalls. The specific goal of this research was to create an HTML browser that could use capability confinement on a collection of plug-replaceable, possibly malicious, rendering engines. In confining the renderer, the browser would ensure that a malicious renderer could do no harm either to the browser or to the underlying system.

Peer-reviewed Articles

See also Usable Security and Capabilities bibliography.

  • D. Devriese, Birkedal, and Piessens
    Reasoning about Object Capabilities with Logical Relations and Effect Parametricity
    1st IEEE European Symposium on Security and Privacy, Congress Center Saar, Saarbrücken, GERMANY, 2016.

  • 2015 Clean Application Compartmentalization with SOAAP Khilan Gudka, Robert N. M. Watson, Jonathan Anderson, David Chisnall, Brooks Davis, Ben Laurie, Ilias Marinos, Peter G. Neumann, and Alex Richardson. ACM CCS 2015.

  • Gerwin Klein, June Andronick, Kevin Elphinstone, Toby Murray, Thomas Sewell, Rafal Kolanski and Gernot Heiser
    Comprehensive formal verification of an OS microkernel
    ACM Transactions on Computer Systems, Volume 32, Number 1, pp. 2:1-2:70, February, 2014

  • S. Clebsch and S. Drossopoulou
    Fully concurrent garbage collection of actors on many-core machines
    OOPSLA 2013

  • Mark S. Miller, Tom Van Cutsem, Bill Tulloh
    Distributed Electronic Rights in JavaScript
    ESOP'13 22nd European Symposium on Programming, Springer (2013)

  • Maffeis, Sergio, John C. Mitchell, and Ankur Taly. Object capabilities and isolation of untrusted web applications. In 2010 IEEE Symposium on Security and Privacy, pp. 125-140. IEEE, 2010.

  • 2010 Capsicum: Practical Capabilities for UNIX Robert N. M. Watson, Jonathan Anderson, Ben Laurie, and Kris Kennaway. USENIX Security 2010.

  • Barth, Adam, Joel Weinberger, and Dawn Song.
    Cross-Origin JavaScript Capability Leaks: Detection, Exploitation, and Defense. USENIX security symposium. 2009.

  • Close, T.: Web-key: Mashing with permission. In: W2SP’08. (2008)

  • Miller MS
    Robust composition: towards a unified approach to access control and concurrency control
    Ph.D. Thesis, Johns Hopkins University; 2006.

    When separately written programs are composed so that they may cooperate, they may instead destructively interfere in unanticipated ways. These hazards limit the scale and functionality of the software systems we can successfully compose. This dissertation presents a framework for enabling those interactions between components needed for the cooperation we intend, while minimizing the hazards of destructive interference.

    Great progress on the composition problem has been made within the object paradigm, chiefly in the context of sequential, single-machine programming among benign components. We show how to extend this success to support robust composition of concurrent and potentially malicious components distributed over potentially malicious machines. We present E, a distributed, persistent, secure programming language, and CapDesk, a virus-safe desktop built in E, as embodiments of the techniques we explain.

  • Miller, Mark S., E. Dean Tribble, and Jonathan Shapiro. Concurrency among strangers. TGC. Vol. 5. 2005.

  • Mark S. Miller, Chip Morningstar, Bill Frantz
    Capability-based Financial Instruments
    Proc. Financial Cryptography 2000, Springer-Verlag, Anguila, BWI, pp. 349-378.

    Every novel cooperative arrangement of mutually suspicious parties interacting electronically — every smart contract — effectively requires a new cryptographic protocol. However, if every new contract requires new cryptographic protocol design, our dreams of cryptographically enabled electronic commerce would be unreachable. Cryptographic protocol design is too hard and expensive, given our unlimited need for new contracts. Just as the digital logic gate abstraction allows digital circuit designers to create large analog circuits without doing analog circuit design, we present cryptographic capabilities as an abstraction allowing a similar economy of engineering effort in creating smart contracts. We explain the E system, which embodies these principles, and show a covered-call-option as a smart contract written in a simple security formalism independent of cryptography, but automatically implemented as a cryptographic protocol coordinating five mutually suspicious parties

Star History

Star History Chart

awesome
awesome-list
capabilities
capability-based
javascript
ocap
ocaps
security
web-security

Similar repos

endojs/endo

Endo is a distributed secure JavaScript sandbox, based on SES

1,062

cloudflare/cloudflare-os

Agent workspace built on Cloudflare Workers for creating documents, building apps, and running…

10,027

cloudflare/capnweb

JavaScript/TypeScript-native, low-boilerplate, object-capability RPC system

3,988

sindresorhus/awesome

😎 Awesome lists about all kinds of interesting topics [NOTE: Pull requests are temporarily…

508,797

bayandin/awesome-awesomeness

A curated list of awesome awesomeness

33,680

tldrsec/awesome-secure-defaults

Awesome secure by default libraries to help you eliminate bug classes!

725

anaibol/awesome-serverless

:cloud: A curated list of awesome services, solutions and resources for serverless / nobackend…

7,584

osirislab/awesome-rust-security

Curated list of awesome projects and resources related to Rust and computer security

605

Contributors

dckc

167 commits

wsargent

3 commits

kephas

1 commits

meejah

1 commits

Languages

JavaScript

60.0%

Python

40.0%